/>iOn May 23, the CFPB notified a Kentucky federal court that it now considers its own 2023 open banking rule “unlawful” and plans to set the rule aside. The Bureau announced its intent to seek summary judgement against the rule, which was issued under Section 1033 of the Dodd-Frank Act to promote consumer-authorized data sharing with third parties.
The original rule (previously discussed here), issued in October 2023 under former Director Rohit Chopra, was designed to implement Section 1033’s mandate by requiring financial institutions to provide consumers and authorized third parties with access to their transaction data in a secure and standardized format. The rule aimed to promote competition and consumer control over financial information by enabling the use of fintech apps and digital tools to manage personal finances.
The lawsuit, filed in the U.S. District Court for the Eastern District of Kentucky, challenged the rule on several grounds, including claims that the CFPB exceeded its statutory authority and imposed obligations not contemplated by Congress. Key points raised in the challenge include:
- Alleged lack of CFPB authority. Plaintiffs argue the Bureau overstepped by mandating free, comprehensive data access and imposing new compliance burdens without clear congressional authorization.
- Interference with industry-led initiatives. The plaintiffs asserted that the rule would disrupt private-sector open banking frameworks already set in place, which they claim serve hundreds of million of Americans.
- Concerns about data security and consumer harm. The rule’s opponents caution that mandating third-party data access could increase risks of misuse or breaches.
Putting It Into Practice: While the litigation had previously been paused to give the agency time to evaluate the regulation, the Bureau’s latest filing confirms that Acting Director Russel Vought no longer supports the rule and now views it as unlawful. This move effectively puts the rule’s validity in the hands of the court, even as compliance deadlines—set to begin April 1, 2026—technically remain in place unless the rule is vacated. Given the rule’s prior bipartisan support and its importance to fintech stakeholders, market participants should continue monitoring this litigation closely for further developments.
